crypto: allow runtime opt in using SSLv2/SSLv3 #8555
Conversation
This change disables SSLv2/SSLv3 use by default, and introduces a command line flag to opt into using SSLv2/SSLv3. SSLv2 and SSLv3 are considered unsafe, and should only be used in situations where compatibility with other components is required and they cannot be upgrade to support newer forms of TLS.
Nodejs-Jenkins
changed the title
| @@ -125,7 +126,6 @@ static Persistent<String> enter_symbol; | |||
| static Persistent<String> exit_symbol; | |||
| static Persistent<String> disposed_symbol; | |||
|
|
|||
|
|
|||
|
One minor nit, otherwise LGTM |
|
👍 from me on this. Honestly, I think at this point if you're going to opt into ssl2 you may as well just start yelling your sensitive data out of the window anyway, but I'm glad it'll be off by default. SSLv3 is a little more used and problematic to disable from the onset, but with the fallback method build into today's OpenSSL release the downsides of that move should be relatively minimized, so 👍. I presume OpenSSL 1.0.1j will be worked in to close the other CVEs disclosed and then new releases of the 10 & 11 branches pushed? |
|
1.0.1j is already landed in both 0.10 and 0.12 branches |
|
Awesome. Is there a release in the works once this issue is settled? |
|
There will be a v0.10 release tomorrow |
|
Thanks, Will keep an eye out for it. Appreciate the replies. |
|
@tjfontaine It looks like the v0.12 branch didn't get OpenSSL 1.0.1j and is still on 1.0.1i. Any plans to update and address the POODLE vulnerability in 0.12? |
|
^ 👍 for that. The devel builds getting left behind consistently on SSL vulns is a little troubling. |
|
Should be fixed by nodejs/node#1 |
|
Is there any chance of that being reported back to the 0.11.x branch, or is the 0.11.x branch frozen at this point for 0.12? |
|
@DomT4 Not that much, the v0.11 just does not exist anymore, the proper branch in v0.12. |
|
@indutny Cool. Cheers for the clarification, I was a little confused about the status of the 0.11.x branch alongside 0.12. |
This change disables SSLv2/SSLv3 use by default, and introduces a command line flag to opt into using SSLv2/SSLv3.
SSLv2 and SSLv3 are considered unsafe, and should only be used in situations where compatibility with other components is required and they cannot be upgrade to support newer forms of TLS.